National Cyberstrategy (NCS) 3.3 Measures for the objective "Effective identification, prevention, management and defence against cyberincidents" Effective cyberattack detection, prevention, management and defence are key factors in cybersecurity. In order to determine suitable protective measures, it must be clear which threats they are intended to counter. If an incident does occur, suitable tools, data and processes are needed to deal with it. The next step is to identify the perpetrators of the attack as precisely as possible (attribution). This in turn makes it easier to assess the threat situation more accurately and to prevent future attacks. Crisis management becomes necessary if cyberincidents affect the functionality of critical infrastructures or Switzerland's security. For crisis management to work, it must be practised regularly. Finally, measures to protect one's own systems are not the only options for defending against cyberattacks. It is important that technical data about attackers, their infrastructure and their modi operandi are collected and made available to potential victims. Active measures to detect threats, to identify attackers and to disrupt and prevent attacks are also possible. M8 Incident management Description Overview of measure Since there is no complete protection against cyberincidents, setting up and operating an incident management organisation is one of the core tasks of cybersecurity. Incident management involves detecting incidents as early as possible, identifying and implementing the appropriate countermeasures, and analysing the incidents in order to derive findings for improving prevention. This task requires specialised skills, analytical tools, a smoothly functioning organisation with clearly defined decision-making powers, and close cooperation between all the relevant federal units. Sharing information among trustworthy partners about incidents and possible countermeasures is crucial, given that incidents often affect different units simultaneously and can therefore be dealt with more quickly and effectively if all the affected units share relevant information. 23